https://th3b0ywh0l1v3d.github.io/tags/session-hijacking/ Recent content in Session-Hijacking on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/padelify/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/padelify/ A padel-tournament portal behind a deny-list ModSecurity WAF falls to a three-step chain: a User-Agent header bypass, a stored XSS that steals a moderator bot’s session cookie, and an LFI that leaks admin creds via full per-character URL-encoding.